Questions tagged [malware]
Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
2,501
questions
0
votes
0
answers
13
views
How did a website disable Alt-F4 and Alt-Tab? [migrated]
I was browsing around on Chrome on a Windows 10 computer, and inadvertently clicked on an ad that appeared under my mouse.
Immediately, the browser went full screen and showed a website saying that ...
- 101
0
votes
0
answers
29
views
Malicious software connecting to localhost port 4789 (VXLAN) [closed]
Firstly, I am being targeted by a skilled hacker.
I'm on an Ubuntu 22.04 machine.
UFW rules are turned on to:
Deny all incoming
Deny all outgoing except:
8.8.8.8 port 53
8.8.4.4 port 53
1.1.1.1 ...
0
votes
0
answers
29
views
I am trying to identify suspicious content within a PDF file
I have a PDF file that has been sent to me as part of a suspicious email. I viewed the email as message source from within outlook. This gave me all raw text within the email. I copied this to ...
- 1
0
votes
0
answers
8
views
Strange window opens randomly and closes very quickly [migrated]
It has been some time now that in Windows 11, I experience this weird issue:
Now and then, I see a window (something bigger than a command prompt) opening and closing immediately.
It has a blue color, ...
0
votes
1
answer
57
views
Malware in neural networks
Lately, there has been discussion about malware hidden inside deep neural networks, such as, EvilModel: Hiding Malware Inside of Neural
Network Models (pdf).
I understand the hiding part, but I would ...
0
votes
0
answers
40
views
USB Drive Malware (.lnk extension) Suspicions: Seeking Advice on Next Steps
I recently encountered a concerning situation involving a USB drive, and I'm seeking guidance on how to proceed.
The scenario:
I used an older computer to extract photos from a DVD and transferred ...
- 1
0
votes
1
answer
47
views
In case of multiple websites using a single IP, and we have been asked to perform vulnerability assessment to ensure its security, how many to target
When doing black-box vulnerability assessment (with permission of course) of a subdomain of a website, the first step is enumeration; and the first step of that is finding IP of the subdomain.
If you ...
- 121
-1
votes
1
answer
126
views
Will Remote Access Trojans work on an offline PC?
Using a USB memory stick that was frequently used on a Trojan-infected PC on an uninfected offline Windows 10 PC. Physically, the PC has no wireless adapter, so it cannot be connected to wifi. ...
0
votes
1
answer
85
views
Malware infection to wifi router from android phone
Suppose a wifi router has strong admin password, updated firmware and no vulnurability then -
Is the router safe from malware infection from android phones connected to it?
Can malware from an ...
- 21
0
votes
0
answers
86
views
Is UAC an overestimated protection measure in Windows? Does Linux do it better?
Windows is an API-based operating system, whereas Linux is file-based. Hence in my opinion, any operating system API security measures alone aren't effective in Windows. One of such examples would be ...
- 1,544
0
votes
0
answers
24
views
i found an inserted script in all my pages and posts [duplicate]
I found this script in all my pages & posts and custom CSS. I want to delete it and prevent regenerating it again. This script stopped me from updating custom css in customize.
please help if you ...
0
votes
0
answers
52
views
Can malware module be signed as Microsoft Corporation module?
In this security tutorial:
https://youtu.be/dykc9YC9Z6U?t=257
the author claims that "sihost is a network component of the malware..." (at 4:23). Yet, prior to his claim, at 3:09 he shows ...
- 101
1
vote
1
answer
75
views
Github repos with CVEs mentioned and no real content
When I look for proof-of-concepts of a security vulnerability, I often see this kind of Github repositories:
https://github.com/Satheesh575555/linux-4.19.72_CVE-2023-0386
https://github.com/nidhi7598/...
- 232
0
votes
1
answer
127
views
How does Windows Defender for Mac block applications and how can people evade the block?
I am using MS Defender for Mac to specify a list of unwanted applications on the managed devices in my company. I am concerned that some users try to evade the detection by altering the binaries of ...
- 51
0
votes
0
answers
50
views
How to isolate a bash script process?
I have a bash script that opens various random files that could be anything (PDF, xlsx, MKV, MP4, WebM, html). Since I don't fully trust the source of these files, there is a chance that some of them ...
0
votes
1
answer
45
views
Static malware analysis using machine learning
As you know, using machine learning we can detect malware.
We can use dynamic analysis based on WinAPI function calls and their arguments.
But what about static analysis using machine learning? In ...
0
votes
0
answers
9
views
Seeking advice for possible virus [duplicate]
I have grown suspicious because I just witnessed powershell opening and immediately closing very fast and multiple times, probably 15 times. After that, the same happened with schtasks.exe. The ...
0
votes
0
answers
36
views
Can malicious files be traced and removed from my phone
I had a files analysis done on my phone using Falcon Sandbox. An alarming amount of malicious files,marked as clean, were found,identified,and shown each capable abilities. Literally THE ONLY thing of ...
2
votes
1
answer
224
views
Downloaded a .scr file (didn't click), will it harm my computer?
I've downloaded a .rar file and extracted it. I have seen that there is a file with extension .scr and in a few seconds, my Windows Defender warned me that a threat had been found. So I just deleted ...
1
vote
0
answers
77
views
Practical examples of a trusting trust attack
Ken Thompson's famous trusting trust paper describes an attack wherein a compiler is subverted, and subsequently subverts all software it compiles, including itself. I have always thought the idea of ...
- 11
1
vote
1
answer
356
views
Is it possible to attack using a CDN as a cover?
I had a security engineer analyze a packet capture from my machine.
About five IPs were used in an attack. It was the only IP (6) that was detected multiple times by VirusTotal.
The IP is 209.197.3.8. ...
0
votes
1
answer
86
views
How to know if you have downloaded a malware on a virtual machine [duplicate]
First, I'm a complete beginner, my only experience in malware is running windows defender lol. But I will try my best to learn anything that you guys recommend.
My younger brother keeps downloading ...
2
votes
1
answer
133
views
Is running rsync as root problematic?
Is there a security risk with running rsync as root to copy potentially malicious files? Or for that matter with any read command like cp, cat, du?
Background:
I'm moving data from various systems ...
- 21
0
votes
0
answers
38
views
How to "clean" PDF to remove non-text and non-images in Product User Manual? [duplicate]
I need guidance on, with the least security risk, how to edit Product User Manuals and Engineering Drawings PDFs from the internet.
Antivirus is insufficient, according to advice from a website which ...
34
votes
4
answers
9k
views
Domain about to expire. Afraid that new owners will spread malware
I have a domain that is about to expire. It was used for hosting my freeware which I do not maintain anymore but can still be found on shareware directories. The application points to my domain (...
- 2,483
0
votes
0
answers
61
views
Is it possible to have infected Computer A infect Computer B whilst being only connected by an Ethernet cable? [duplicate]
Is it possible to have infected Computer A infect Computer B whilst being only connected by an Ethernet cable?
My current research into worms is that they always seem to require an additional vector ...
0
votes
1
answer
100
views
Why some ransomware adds padding to headers
Does anyone know why some ransomware families (e.g. Cuba but also Phobos if I am not mistaken) pad the file header to get to 1024 bytes?
I mean what would be a reason for the ransomware developer to ...
0
votes
1
answer
103
views
Can virus survive macOS Recovery?
In what scenarios would a MacOS virus/malware/rootkit/etc (I use those terms to englobe all types of undesirable or malicious software or code) resist a format of the hard drive in MacOS recovery?
I ...
- 21
0
votes
0
answers
104
views
What information does the Microsoft Intelligent Security Graph use for querying files?
I'm looking into WDAC and the option to use Microsoft's ISG for files that are not explicitly allowed or denied caught my interest. Unfortunately I haven't been able to find any information on what is ...
- 11
-1
votes
2
answers
105
views
Help: Does this website contain malware? [closed]
My grandmother told me she visited a site to buy something but it did not open properly. It does look like it redirects to something else. It could be malware.
Website: sanjaytools.com. Browser: ...
- 3
1
vote
1
answer
579
views
How to decrypt LockBit encrypted files
I've got an emergency on my PC. I remotely connected to it using Remote Desktop Connection a couple of days ago and I worked on my PC for a while and logged off. Later, when I went to log back on, I ...
0
votes
1
answer
115
views
Do viruses survive in other drive and than re infect after resetting the PC?
Backstory:
I got infected while installing some shady software and at that time I kept Windows Defender off, (I have very much faith on my shady website) by turning its features off. But when I ...
0
votes
0
answers
29
views
How to proceed once your machine has been infected? [duplicate]
I have a Windows 10 machine. Around a week ago, someone was able to purchase stuff using my credit card, before I was able to lock my card. For a few weeks before then, I'd noticed that my computer ...
- 1
1
vote
2
answers
184
views
What are some symptoms of malware exfiltrating data in packet captures?
I am concerned that my Linux laptop has been compromised with malware that is remotely and regularly monitoring my activity. I ran Wireshark for a day to see if I could find any symptoms of data being ...
- 11
0
votes
1
answer
80
views
Successful UEFI secure boot exploitation
Are there any real examples (malware, rootkits, etc.) of exploiting the UEFI secure boot mechanism vulnerabilities such as CVE-2022-21894?
- 2,552
0
votes
0
answers
29
views
Need assistance with hacked website [duplicate]
I need help about this: Is this script malicious? What does it do?
I have the same problem in my site, how could I fix that? I tried to place clean wordpress files but the problem persists.
0
votes
1
answer
65
views
How to make VBA code stay hidden even after vba stomping?
I am experimenting with VBA stomping in microsoft word documents.
I have done it manually but also with the evilClippy tool aswell.
What i have noticed is that, although the original vba code stays ...
- 23
2
votes
1
answer
94
views
PC to iOS, USB storage Malware?
I have a laptop, with Windows 7, no internet (with the wifi adapter physically removed). I want to use that machine for stuff like old abandonware, and don’t want to risk any type of malware or virus ...
- 21
0
votes
2
answers
204
views
Chance of virus/malware and non-executable files
I’ve seen this question being asked so many times, but I still have questions.
I know that to execute malicious code from non-executable files such as videos (mp4), audios (mp3) and documents (pdf), ...
1
vote
0
answers
99
views
Has my browser been infected after visiting malicious link?
Today I typed in a URL of a site I know. Unfortunately I missed one letter of the TLD. I typed .co instead of .com.
No problem, I'll quickly retype the URL. Unfortunately, this was not possible. The ...
- 111
0
votes
1
answer
70
views
Using a program that likely has a trojan horse? [closed]
OP wants to back up his Blu-ray/4K collection to a HDD.
OP suspects that a very popular program that makes MKVs is actually a trojan horse that infects host computer's USB drives, which can later be ...
0
votes
1
answer
85
views
Verify the safety of old back ups
I have an old laptop that I've been using since high school, and for a long time I wasn't careful with how I used it. Namely, I shared USBs with friends and teachers for assignments and presentations, ...
- 1
0
votes
0
answers
485
views
How to inspect for potential malware on pdf attachment?
I received an email at work the other day from a client (with the correct email address) that had a pdf attached. When I opened the pdf, it said the client had required the recipient to login to ...
- 9
0
votes
0
answers
60
views
Technical details behind how a malware-infected device infects other devices on the same network?
I'm a security student and for one of my projects, I'm trying to learn the technical details behind a malware-infected device infecting other devices on the same network. I can see so much content ...
- 23
1
vote
0
answers
90
views
USB SSD Backdoor command issue [closed]
In our company we have many SpeedFaster 2TB USB SSDs. They were working perfectly until our endpoint protection software was updated. Currently they work only for a few seconds and are then blocked ...
- 11
1
vote
2
answers
301
views
How easy is it to inject malware into websites?
Please let me present you with a hypothetical scenario. A journalist is targeted by hackers. Said journalist is very careful with email attachments and will not click on them. However, surfing the web ...
- 11
0
votes
0
answers
455
views
Google Sheet with macro opened on Android phone. Will the macro run?
I accidentally opened up a spam mail containing a google drive sheet with a macro on my Galaxy S8 phone. The spam email goes something like:
Headline: "Need action! Withdrawing Funds id - (some ...
0
votes
0
answers
75
views
Is it possible for media files (mp3,mp4) contain malware [duplicate]
I would like to know the technique and if it’s possible in the first one place, not activating the media player the file it self
- 1
0
votes
1
answer
119
views
Can flash drive infect Android and then the Android infect Windows PC?
I found a flash drive outside my home. Thinking one of my neighbors might have dropped it and wanting to return to them (but still wanting to be cautious), I (stupidly) plugged it into an old Android ...
- 1
0
votes
0
answers
26
views
I clicked what looked like an Amazon email, but it (maybe) was from an Amazon affiliate. Ended up at Amazon.com anyway. Can I safely investigate? [duplicate]
In a case of clicking too fast, I clicked on a picture that looked like it was from Amazon. However this was not the case. I did end up at Amazon, but I'm aware that other things could've taken place ...
- 1